ThreatLocker MCP server

ThreatLocker MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to the ThreatLocker Portal API. Manage computers, approval requests, audit logs, and organizations through natural language interactions.

Features

• Stateless Architecture: No session state required, fresh connections per request
• Decision-Tree Navigation: Navigate domains with threatlocker_navigate
• Gateway Mode: Multi-tenant support via HTTP headers
• Elicitation Support: Interactive prompts for missing parameters
• Comprehensive Error Handling: Detailed error messages and logging
• Docker Support: Production-ready containerization

Tools

Navigation

• threatlocker_navigate - Navigate to a domain to see available tools
• threatlocker_status - Check API connection status and available domains

Computers

• threatlockercomputerslist - List computers with filters (search, group, pagination)
• threatlockercomputersget - Get detailed computer information
• threatlockercomputersget_checkins - Get computer checkin history

Computer Groups

• threatlockercomputergroups_list - List computer groups with filters
• threatlockercomputergroups_dropdown - Get computer groups for dropdown selection

Approval Requests

• threatlockerapprovalslist - List approval requests with status filters
• threatlockerapprovalsget - Get detailed approval request information
• threatlockerapprovalspending_count - Get count of pending approvals
• threatlockerapprovalsgetpermitapplication - Get permit application details

Audit Log

• threatlockerauditsearch - Search audit log entries with filters
• threatlockerauditget - Get detailed audit log entry
• threatlockerauditfile_history - Get audit history for specific file

Organizations

• threatlockerorganizationslist_children - List child organizations
• threatlockerorganizationsgetauthkey - Get organization auth key
• threatlockerorganizationsformovecomputers - Get organizations for computer moves

Configuration

Environment Variables

Stdio Mode (Direct API Access)

THREATLOCKER_API_KEY=your_api_key_here
THREATLOCKER_ORGANIZATION_ID=your_org_id_here
MCP_TRANSPORT=stdio

Gateway Mode (Multi-tenant)

AUTH_MODE=gateway
MCP_TRANSPORT=http
MCP_HTTP_PORT=8080
MCP_HTTP_HOST=0.0.0.0

Gateway Mode Headers

When running in gateway mode, include these headers with each request:

• X-Threatlocker-Api-Key: Your ThreatLocker API key
• X-Threatlocker-Organization-Id: Your organization ID

Logging

LOG_LEVEL=debug|info|warn|error  # Default: info

Local Development

1. Clone the repository:

git clone https://github.com/WYRE-AI/threatlocker-mcp.git
cd threatlocker-mcp

1. Install dependencies:

npm install

1. Set environment variables:

cp .env.example .env
# Edit .env with your ThreatLocker credentials

1. Build and run:

npm run build
npm start

# Or for development with hot reload:
npm run dev

1. Test the server:

# Stdio mode
echo '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}' | npm start

# HTTP mode
curl http://localhost:8080/health

Docker

Using Docker Compose

# Pull and run latest image
docker compose up -d

# Or build locally
docker compose -f docker-compose.dev.yml up --build

Using Docker directly

# Gateway mode (recommended)
docker run -d \
  --name threatlocker-mcp \
  -p 8080:8080 \
  -e AUTH_MODE=gateway \
  ghcr.io/wyre-ai/threatlocker-mcp:latest

# Stdio mode
docker run -d \
  --name threatlocker-mcp \
  -e THREATLOCKER_API_KEY=your_key \
  -e THREATLOCKER_ORGANIZATION_ID=your_org_id \
  -e MCP_TRANSPORT=stdio \
  ghcr.io/wyre-ai/threatlocker-mcp:latest

Architecture

Shortened. The full README is on GitHub.